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(54) Method for intrusion detection in a database system 



(57) A method for detecting intrusion in a database, 
managed by an access control system, comprising de- 
fining at least one intrusion detection profile, each com- 
prising at least one item access rate and associating 
each user with one of said profiles. Further, the method 
determines whether a result of a query exceeds any one 
of the item access rates defined in the profile associated 
with the user, and, in that case, notifies the access con- 



trol system to alter the user authorization, thereby mak- 
ing the received request an unauthorized request, be- 
fore said result is transmitted to the user. 

The method allows for a real time prevention of in- 
trusion by letting the intrusion detection process interact 
directly with the access control system, and change the 
user authority dynamically as a result of the detected 
intrusion. 
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